From 03de371289338da20ddd50785d5ff1faa1175faa Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 11:44:48 +0200
Subject: [PATCH] mongodb-ce: unbreak on darwin

Co-Authored-By: FlameFlag <git@ps1.sh>
(cherry picked from commit 651f3b12fd44a5c920a5d91bb8bff12c79fe7598)
---
 pkgs/by-name/mo/mongodb-ce/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 66b2d4306eaa..2a73f1a2a0df 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/mongod";
 
+  # Apple's LibreSSL tries to read this while running `mongod --version`
+  sandboxProfile = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    (allow file-read* (literal "/private/etc/ssl/openssl.cnf"))
+  '';
+
   passthru = {
     sources = {
       "x86_64-linux" = fetchurl {